§ 46 LDSG SH
Records of processing activities
(1)The controller shall maintain a record of all categories of processing activities under its responsibility. That record shall contain the following information: 1. the name and contact details of the controller and, where applicable, of the joint controller, as well as the name and contact details of the data protection officer, 2. the purposes of the processing, 3. the categories of recipients to whom the personal data have been or will be disclosed, 4. a description of the categories of data subjects and the categories of personal data, 5. where applicable, the use of profiling, 6. where applicable, the categories of transfers of personal data to bodies in a third country or to an international organisation, 7. information on the legal basis of the processing, 8. the envisaged time limits for the erasure or the review of the necessity of the storage of the various categories of personal data, and 9. a general description of the technical and organisational measures pursuant to § 40.
(2)The processor shall maintain a record of all categories of processing carried out on behalf of a controller, which shall contain the following: 1. the name and contact details of the processor, of each controller on whose behalf the processor is acting, and, where applicable, of the data protection officer, 2. where applicable, transfers of personal data to bodies in a third country or to an international organisation, specifying the country or organisation, and 3. a general description of the technical and organisational measures pursuant to § 40.
(3)The records referred to in paragraphs 1 and 2 shall be maintained in writing or in electronic form.
(4)Controllers and processors shall make their records available to the Land Commissioner upon request. zur Einzelansicht § 46